-
Notifications
You must be signed in to change notification settings - Fork 1
Update dependency sbt/sbt to v1.11.7 #21
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weβll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
renovate
wants to merge
1
commit into
main
Choose a base branch
from
renovate/sbt-sbt-1.x
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9bfbbe6 to
b278a71
Compare
b278a71 to
59162e3
Compare
59162e3 to
fd1092e
Compare
fd1092e to
c3ef7fd
Compare
c3ef7fd to
484d3d9
Compare
484d3d9 to
8b1dabf
Compare
8b1dabf to
3d39898
Compare
3d39898 to
af210ac
Compare
af210ac to
de91709
Compare
de91709 to
d10b8b4
Compare
9f07701 to
af0e148
Compare
af0e148 to
3cd8aa7
Compare
3cd8aa7 to
ab2ade8
Compare
ab2ade8 to
db545fa
Compare
db545fa to
154c3ad
Compare
154c3ad to
9178447
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.10.0->1.11.7Release Notes
sbt/sbt (sbt/sbt)
v1.11.7: 1.11.7Compare Source
π updates
--sun-misc-unsafe-memory-access=allowand--enable-native-access=ALL-UNNAMEDflags to suppress JDK 25 warnings by @βeed3si9n in #β8304runMaintask for JEP-512/JEP-445 Main by @βxuwei-k in #β8316UpdateReportby configurations by @βmdedetrich in sbt/librarymanagement#547π bug fixes
π¬ behind the scenes
fallback-dependencies-inter-projecttest by @βxuwei-k in #β8319run/daemon-exittest by @βxuwei-k in #β8320Full Changelog: sbt/sbt@v1.11.6...v1.11.7
v1.11.6: 1.11.6Compare Source
π sbt launcher 1.5.0
-Xsource:3option by @βxuwei-k in sbt/launcher#117π bug fixes
π¬ behind the scene
Full Changelog: sbt/sbt@v1.11.5...v1.11.6
v1.11.5: 1.11.5Compare Source
changes with compatibility implications
ubuntu-22.04image, which will require similar Linux version with glibc 2.32 and above.π features and other updates
--jvm-clientto thesbtrunner script to launch JVM client. See belowScala Nightly repository
Scala Team now publishes nightlies to a dedicated Artifactory instance. sbt 1.11.5 adds a new resolver for this:
This was contributed by @βhamzaremmal in sbt/librarymanagement#532
Scala 3.8.0 support
Scala 3.8.0 will in-source the Scala standard library (
scala-library) instead of using one from Scala 2.13. sbt 1.11.5 relaxes the Coursier same-version enforcement to support Scala 3.8.0.This was pair programmed by @βhamzaremmal + @βeed3si9n during Scala Days 2025 as #β8226
sbt --jvm-clientsbt 1.11.5 runner script adds new
--jvm-clientflag to launch the JVM version of the thin client. The implementation is the Scala code which sbtn is based on. This will be useful on platforms or CPU architectures that we do not build sbtn.This was contributed by @βeed3si9n in #β8232
π¬ behind the scene
new contributors
Full Changelog: sbt/sbt@v1.11.4...v1.11.5
v1.11.4: 1.11.4Compare Source
Updates
sonaUploadRequestTimeoutby scoping globally by @βeed3si9n in #β8190Full Changelog: sbt/sbt@v1.11.3...v1.11.4
v1.11.3: 1.11.3Compare Source
updates
sonaUploadRequestTimeoutsetting to configure the upload timeout when publishing to the Central Repo by @βguizmaii in #β8171pluginCrossBuild/sbtBinaryVersion"1.3", which is used by IntelliJ Scala plugin (fixes #β8166) by @βunkarjedy in #β8167new contributors
Full Changelog: sbt/sbt@v1.11.2...v1.11.3
v1.11.2: 1.11.2Compare Source
updates
updatetask by reverting the use ofWeakReferences by @βmrdziuban in coursier/sbt-coursier#564Resolver.sonatypeCentralSnapshots,Resolver.sonatypeCentralRepo(...)and deprecatesResolver.sonatypeOssRepos(...),Opts.resolver.sonatypeOssReleases,Opts.resolver.sonatypeOssSnapshots, etc by @βeed3si9n in sbt/librarymanagement#517 / #β8156Full Changelog: sbt/sbt@v1.11.1...v1.11.2
v1.11.1: 1.11.1Compare Source
updates
updatetask by @βmrdziuban in coursier/sbt-coursier#563sbtPluginPublishLegacyMavenStyleto false by @βeed3si9n in #β8148sonaDeploymentNametoexcludeLintKeysby @βrtyley in #β8143behind the scene
Full Changelog: sbt/sbt@v1.11.0...v1.11.1
v1.11.0: 1.11.0Compare Source
Central Repository publishing
The Central Repository (aka Maven Central) has long been the pillar of the JVM ecosystem including Scala. The mechanism to publish libraries to the Central has been hosted by Sonatype as OSS Repository Hosting (OSSRH) via HTTP PUT, but in March it was announced that the endpoint will be sunset in June 2025 in favor of the Central Portal at https://central.sonatype.com/.
sbt 1.11.0 implements a built-in support to publish to Central Repository via the Central Portal. To publish to the Central Portal, first set
ThisBuild / publishTosetting to thelocalStagingrepository:Add
credentialsto the hostcentral.sonatype.comusing the generated user token user name and password. sbt 1.11.0 will read from the environment variablesSONATYPE_USERNAMEandSONATYPE_PASSWORDand append a credential forcentral.sonatype.comout-of-box, which might be useful for automatic publishing from the CI environment, such as GitHub Actions.When you're ready to publish, call
publishSignedtask (available via sbt-pgp). At this point, the JARs and POM files will be staged to your localtarget/sona-stagingdirectory.Next, call
sonaUploadto upload to the Central Portal and manually release the bundle, or callsonaReleaseto upload and automatically release to the Central Repository.This was contributed by @βeed3si9n in #β8126. The feature was inspired by sbt-sonatype workflow pioneered by Taro Saito, and sonatype-central-client spearheaded by David Doyle at Lumidion.
Other updates
testQuick) with companion objects by @βeed3si9n in #β8087Full Changelog: sbt/sbt@v1.10.11...v1.11.0
v1.10.11: 1.10.11Compare Source
updates
π bug fixes
compiletask retrying itself on compiler crashes by @βeed3si9n in #β8070sbt --client shutdownshortcuts if the server is not already running by @βeed3si9n in #β8057sbt --clienton Windows by @βeed3si9n in #β8071sbt --versionby @βeed3si9n in #β8066Full Changelog: sbt/sbt@v1.10.10...v1.10.11
v1.10.10: 1.10.10Compare Source
π bug fixes
Full Changelog: sbt/sbt@v1.10.9...v1.10.10
v1.10.9: 1.10.9Compare Source
π features and other updates
allowUnsafeScalaLibUpgradesetting to opt-out of the Scala 2.13 compatibility check (SIP-51) by @βlrytz in #β8012jvmBuildTargetforworkspace/buildTargetsby @βFriendseeker in #β7913π bug fixes
Compile / clean,Test / cleanby @βFriendseeker in #β7969previousCompileby @βFriendseeker in #β7983sbt initby @βeed3si9n in #β8049π¬ behind the scene
new contributors
Full Changelog: sbt/sbt@v1.10.7...v1.10.9
v1.10.8: 1.10.8Compare Source
sbt 1.10.8 is dead on arrival, please use 1.10.9 when it comes out.
v1.10.7: 1.10.7Compare Source
π features and other updates
--allow-emptyby @βeed3si9n in #β7966Build directory detection
Starting 1.10.7, the
sbtrunner script enables build directory detection by default. This means that thesbtwill exit with error when launched in a directory withoutbuild.sbtorproject/, with exceptions ofsbt new,sbt --script-versionetc.To override this behavior temporarily, you can use
--allow-emptyflag. To permanently opt out of the build directory detection, create$XDG_CONFIG_HOME/sbt/sbtoptswith--allow-emptyin it.csrMavenDependencyOverride setting
sbt 1.10.7 updates Coursier from 2.1.19 β 2.1.22. sbt 1.10.7 also adds a new setting
csrMavenDependencyOverride(default:false), which controls the resolution, which respects Maven dependency override mechanism, also known as bill-of-materials (BOM) POM. Since there is a performance regression in the new resolver, we are setting the default tofalse.π bug fixes
csrMavenDependencyOverrideto opt into bill-of-material (BOM) respecting Coursier resolution by @βeed3si9n in #β79709a88bc4and Jansi to 2.4.1, which fixes crash on Windows on ARM by @βFriendseeker in #β7952π¬ behind the scene
1.10.7by @βFriendseeker in #β7957Full Changelog: sbt/sbt@v1.10.6...v1.10.7
v1.10.6: 1.10.6Compare Source
change with compatibility implication
bug fixes and updates
runtask due to bgRun delegation by @βFriendseeker in #β7916sbt --clientsupport on openSUSE by @βAndroz2091 in #β7895dependencyTreeconsole output by @βFriendseeker in #β7906java.awt.Desktop.browse()duringdependencyBrowseTreeby @βFriendseeker in #β7905useConsistenttostaticCachedStoreby @βFriendseeker in #β7869ConsistentAnalysisFormatby @βFriendseeker in sbt/zinc#1479cleanclearspreviousCompileby @βFriendseeker in sbt/zinc#1487 / #β7922behind the scene
org.fusesource.jansiby @βFriendseeker in #β78761.10.6by @βFriendseeker in #β78718by @βFriendseeker in #β7897sbt.TagsTestby @βFriendseeker in #β7919loading settings for projectby @βFriendseeker in #β7909dependencyBrowseGraphTarget,dependencyBrowseTreeTargetby @βFriendseeker in #β7904new contributors
Full Changelog: sbt/sbt@v1.10.5...v1.10.6
v1.10.5: 1.10.5Compare Source
updates
1when on error by @βFriendseeker in #β7854++with a command argument with slash by @βeed3si9n in #β7862behind the scene
System.console == nullby @βFriendseeker in #β78431.10.5by @βFriendseeker in #β7840Full Changelog: sbt/sbt@v1.10.4...v1.10.5
v1.10.4: 1.10.4Compare Source
updates and bug fixes
sbt newfails to find template by @βFriendseeker in #β7835~withGlobal / onChangedBuildSource := ReloadOnSourceChangesby @βFriendseeker in #β7838behind the scene
DEVELOPING.mdby @βFriendseeker in #β7784TEST_SBT_VERto 1.10.3 & remove unused CI variables by @βFriendseeker in #β7825.java-versionto not fix java version to 1.8 by @βFriendseeker in #β78273.27.1by @βFriendseeker in #β7829Full Changelog: sbt/sbt@v1.10.3...v1.10.4
v1.10.3: 1.10.3Compare Source
Protobuf with potential Denial of Service (CVE-2024-7254)
sbt 1.10.3 updates protobuf-java library to 3.25.5 to address CVE-2024-7254 / GHSA-735f-pc8j-v9w8, which states that while parsing unknown fields in the Protobuf Java library, a maliciously crafted message can cause a StackOverflow error. Given the nature of how Protobuf is used in Zinc as internal serialization, we think the impact of this issue is minimum. However, security software might still flag this to be an issue while using sbt or Zinc, so upgrade is advised. This issue was originally reported by @βgabrieljones and was fixed by Jerry Tan (@βFriendseeker) in zinc#1443.
@βadpi2 at Scala Center has also configured dependency graph submission to get security alerts in zinc#1448. sbt/sbt was configured by @βFriendseeker in #β7746.
Reverting the invalidation of circular-dependent sources
sbt 1.10.3 reverts the initial invalidation of circular-dependent Scala source pairs.
There had been a series of incremental compiler bugs such as "Invalid superClass" and "value b is not a member of A" that would go away after
clean. The root cause of these bugs were identified by @βsmarter (sbt/zinc#598 (comment)) and @βFriendseeker to be partial compilation of circular-dependent sources where two sourcesA.scalaandB.scalause some constructs from each other.sbt 1.10.0 fixed this issue via sbt/zinc#1284 by invalidating the circular-dependent pairs together. In other words, if
A.scalawas changed, it would immediately invalidateB.scala. It turns out, that people have been writing circular-dependent code, and this has resulted in multiple reports of Zinc's over-compilation (zinc#1420, zinc#1461). Given that the invalidation seems to affect the users more frequently than the original bug, we're going to revert the fix for now. We might bring this back with an opt-out flag later on. The revert was contributed by by Li Haoyi (@βlihaoyi) in sbt/zinc#1462.Improvement: ParallelGzipOutputStream
sbt 1.10.0 via sbt/zinc#1326 added a new consistent (repeatable) formats for Analysis storage. As a minor optimization, the pull request also included an implementation of
ParallelGzipOutputStream, which would reduce the generate file size by 20%, but with little time penalty. Unfortunately, however, we have observed in CI that that thescala.concurrent.Future-based implementation gets stuck in a deadlock. @βIchoran and @βFriendseeker have contributed an alternative implementation that uses Java threads directly, which fixes the issue in sbt/zinc#1466.bug fixes and updates
sbt inittemplate deps by @βxuwei-k in #β7730behind the scene
System.runFinalizationby @βFriendseeker in #β7732Thread.getIdby @βFriendseeker in #β7733vscode-sbt-scalafrom build.sbt by @βFriendseeker in #β7728Full Changelog: sbt/sbt@v1.10.2...v1.10.3
v1.10.2: 1.10.2Compare Source
Changes with compatibility implications
_sbt2_3suffix for sbt 2.x by @βeed3si9n in #β7671Updates and bug fixes
serverIdleTimeOuttoserverIdleTimeoutto match the variable name by @βlervag in #β7651scala.reflect.io.Streamableby @βrochala in sbt/zinc#1395Optionalinter-project dependency in BSP by @βadpi2 in #β7568build.propertiesby @βinvadergir in #β7585scala-tools-releasesinrepositoriesfile blocking sbt from launching by @βeed3si9n in sbt/launcher#104ThreadDeathfor future JDK compatibility by @βxuwei-k in #β7652ZipErrorfor future JDK compatibility by @βeed3si9n in sbt/zinc#1393Behind the scenes
dependency-management/force-update-periodtest (backport of #β7538) by @βadpi2 in #β7567New contributors
Full Changelog: sbt/sbt@v1.10.0...v1.10.2
v1.10.1: 1.10.1Compare Source
bug fixes and updates
expandMavenSettingsby @βdesbo in sbt/librarymanagement#444MapandLListin sjson-new 0.10.1 by @βsteinybot + @βeed3si9n in eed3si9n/sjson-new#142forceUpdatePeriodby @βadpi2 in #β7567Optionalinter-project dependencies by @βadpi2 in #β7568jcenterandscala-tools-releasesentries in the~/.sbt/repositoriesfile by @βeed3si9n in sbt/launcher#104behind the scenes
Full Changelog: sbt/sbt@v1.10.0...v1.10.1
Configuration
π Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
π¦ Automerge: Disabled by config. Please merge this manually once you are satisfied.
β» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
π Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.